CVE-2026-11100: Use after free in File Input in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability in the File Input component of Google Chrome on macOS affects all Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require a user to perform specific UI gestures on a crafted HTML page. Successful exploitation allows a remote attacker to escape Chrome's sandbox, gaining the ability to read, modify, or disrupt data and processes outside the browser's confined environment. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted host must be reachable via a browser session to an attacker-controlled or compromised site.

• AuthenticationNot required

  No account, credential, or session token is needed; any unauthenticated visitor to the malicious page is a valid target.

• Victim interactionRequired

  The user must perform specific UI gestures (such as interacting with a file input element) on the crafted page, making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker escapes Chrome's sandbox and executes arbitrary code in the context of the host macOS user process.
• Confidential data accessible to that user (files, keychain-adjacent secrets, browser-stored credentials) becomes readable by the attacker.
• The attacker can write or modify files and system state outside the browser sandbox, enabling persistence or lateral movement.
• The attacker can crash or destabilize browser and OS-level processes owned by the affected user.